# bp-external-secrets-stores — Catalyst bootstrap-kit Blueprint, slot 15a
# (sub-slot of 15, follows bp-external-secrets controller).
#
# Owns the default ClusterSecretStore CR(s) wiring ESO to bp-openbao.
# Split from bp-external-secrets@1.0.0 (issue #331) to resolve the
# CRD-ordering deadlock — Helm's `before-hook-creation` delete policy on
# the in-line ClusterSecretStore hook ran a kubectl-style lookup of the
# CR before the upstream chart's CRDs finished registering, deadlocking
# the install with `no matches for kind ClusterSecretStore` (incident on
# otech.omani.works 2026-04-30).
#
# Mirrors the bp-crossplane (controller) ↔ bp-crossplane-claims (CRs)
# split shape from PR #247.
#
# Wrapper chart: platform/external-secrets-stores/chart/
# Catalyst-curated values: platform/external-secrets-stores/chart/values.yaml
# Reconciled by: Flux on the new Sovereign's k3s control plane.

---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: bp-external-secrets-stores
  namespace: flux-system
spec:
  type: oci
  interval: 15m
  url: oci://ghcr.io/openova-io
  secretRef:
    name: ghcr-pull
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: bp-external-secrets-stores
  namespace: flux-system
spec:
  interval: 15m
  releaseName: external-secrets-stores
  targetNamespace: external-secrets-system
  # Order — Flux will not start install until bp-external-secrets reaches
  # Ready=True (which means: upstream ESO controller running AND CRDs
  # registered) AND bp-openbao reaches Ready (the secret backend the
  # ClusterSecretStore points at).
  dependsOn:
    - name: bp-external-secrets
    - name: bp-openbao
  chart:
    spec:
      chart: bp-external-secrets-stores
      version: 1.0.0
      sourceRef:
        kind: HelmRepository
        name: bp-external-secrets-stores
        namespace: flux-system
  # Event-driven install per docs/INVIOLABLE-PRINCIPLES.md #3 (Flux
  # dependsOn is the gate, not Helm timeout).
  install:
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    disableWait: true
    remediation:
      retries: 3
